CVE-2026-69151: Angular Framework XSS Vulnerability

CVE-2026-69151 Overview

CVE-2026-69151 affects the Angular compiler's internationalization (i18n) pipeline. The vulnerability permits i18n-onerror and other i18n-on* event-handler attributes to pass through the translation extraction step. A lower-trust translation file can replace a static handler with executable JavaScript, producing a Cross-Site Scripting (XSS) primitive [CWE-79]. The flaw exists in packages/compiler/src/render3/view/i18n/meta.ts, where the guard that rejects translated event attributes did not cover all on* names. Angular versions prior to 20.3.27, 21.2.19, and 22.0.1 are affected.

Critical Impact
Attackers controlling translation files can inject executable JavaScript into applications, leading to session theft, credential harvesting, and full client-side compromise.

Affected Products

Angular versions prior to 20.3.27
Angular versions prior to 21.2.19
Angular versions prior to 22.0.1

Discovery Timeline

2026-08-03 - CVE-2026-69151 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69151

Vulnerability Analysis

Angular's i18n pipeline lets developers mark template attributes for translation using an i18n- prefix. The compiler is expected to block translation of event-handler attributes because a translator could otherwise substitute the handler body with arbitrary JavaScript. The pre-patch check in meta.ts gated only attributes flagged as Trusted Types sinks. Event bindings such as onerror, onclick, and onload were not consistently caught when combined with the i18n- prefix. A crafted translation file targeting i18n-onerror on an element replaces the static handler with attacker-controlled script that executes in the application origin.

Root Cause

The conditional in the i18n attribute validator was too narrow. It relied solely on isTrustedTypesSink and did not additionally reject attribute names beginning with on. Translated event handlers therefore bypassed the disallow-list and reached the rendered DOM.

Attack Vector

Exploitation requires an attacker to supply or modify a translation file (XLIFF, XMB, or JSON) consumed by the Angular build pipeline. Environments accepting community-contributed translations, third-party language packs, or crowd-sourced localization inputs face the greatest exposure. Once the malicious translation is bundled, any user rendering the affected template triggers the injected handler.

typescript

// Patch: packages/compiler/src/render3/view/i18n/meta.ts
            isTrustedType = isTrustedTypesSink(node.name, name);
          }

-          if (isTrustedType) {
+          if (isTrustedType || name.toLowerCase().startsWith('on')) {
            this._reportError(
              attr,
              `Translating attribute '${name}' is disallowed for security reasons.`,

Source: angular/angular commit 6c41f5c

A follow-up hardening replaces the raw on* prefix check with a stricter helper to reduce false positives on short property names:

typescript

// Follow-up: packages/compiler/src/render3/view/i18n/meta.ts
-          if (isTrustedType || name.toLowerCase().startsWith('on')) {
+          if (isTrustedType || isPossibleEventHandler(name)) {
            this._reportError(
              attr,
              `Translating attribute '${name}' is disallowed for security reasons.`,

Source: angular/angular commit 417a407

Detection Methods for CVE-2026-69151

Indicators of Compromise

Translation files (.xlf, .xmb, .json) containing i18n-on* attribute keys such as i18n-onerror, i18n-onclick, or i18n-onload.
Translation unit target strings containing JavaScript keywords like javascript:, alert(, eval(, fetch(, or document.cookie.
Unexpected outbound requests from user browsers to attacker-controlled domains originating from pages rendered with recently updated locale bundles.

Detection Strategies

Scan Angular repositories and CI artifacts for template attributes matching the regular expression i18n-on[a-z]+ and flag any translated overrides.
Diff translation files against a known-good baseline to identify handler substitutions or newly introduced script content in <target> elements.
Enforce a Content Security Policy (CSP) in report-only mode to surface inline-script violations linked to translated content.

Monitoring Recommendations

Log and review all pull requests that modify localization assets, especially those from external contributors or translation vendors.
Alert on browser CSP violation reports referencing inline event handlers on production Angular applications.
Track Angular framework versions across build pipelines and fail builds that resolve to versions below 20.3.27, 21.2.19, or 22.0.1.

How to Mitigate CVE-2026-69151

Immediate Actions Required

Upgrade Angular to 20.3.27, 21.2.19, or 22.0.1 depending on the release train in use.
Audit all translation files for i18n-on* attributes and remove any handler translations before rebuilding.
Rebuild and redeploy affected applications; cached bundles served by CDNs must be invalidated.

Patch Information

The fix is delivered in Angular 20.3.27, 21.2.19, and 22.0.1. Refer to the Angular Security Advisory GHSA-jj27-h5hq-8x99, pull request 68821, and pull request 69306 for the complete change set.

Workarounds

Restrict translation-file authorship to trusted maintainers and require code review for all localization changes.
Enforce a strict Content Security Policy that disallows inline event handlers (script-src without 'unsafe-inline').
Pre-process translation files in the build pipeline to strip any i18n-on* keys before the Angular compiler runs.

bash

# Upgrade Angular to a fixed release
npm install @angular/core@22.0.1 @angular/compiler@22.0.1 --save

# Or for the 21.x line
npm install @angular/core@21.2.19 @angular/compiler@21.2.19 --save

# Or for the 20.x line
npm install @angular/core@20.3.27 @angular/compiler@20.3.27 --save

# Audit translation files for injected event handlers
grep -RIn --include='*.xlf' --include='*.xmb' --include='*.json' \
  -E 'i18n-on[a-z]+' ./src/locale